fix(fetcher): fall back to env token when overlay token absent #71

Merged

nrupard merged 1 commit from fix/VS-51-fetcher-env-token-fallback into main

2026-06-24 16:17:30 +02:00

nrupard commented

2026-06-24 16:04:59 +02:00

Owner

Problem

A persisted settings.agentbinaryfetcher overlay saved through the admin UI without re-typing the redacted token persists with no token. Because the env seed only fills the section when no overlay exists (seed-once) and the seeded token is never written to the DB, that good env token is then shadowed forever: every fetch of the private Forgejo package returns 401, the agent catalog stays empty, and device-enrollment downloads 404 at /vervainagents/:id (surfaced in the apps /agent/<id> proxy as "agent download failed: 404 Not Found"). Hit in production on c-01; recovery required manually re-entering the token in the admin UI.

Fix

Resolve the Forgejo token from VERVAIN_AGENT_FETCHER_TOKEN / ..._TOKEN_FILE when the overlay/config token is absent or blank. New AgentBinaryFetcherConfig::apply_env_token_fallback() (with a testable core fill_forgejo_token_from) in crates/vervain-agent-fetch/src/config.rs, called at the two source-build sites: boot-time fetch (crates/vervain/src/boot.rs) and runtime UI apply (crates/vervain-web/src/settings_overlay.rs).

An explicit non-empty token in the overlay/config still wins (env is fallback only).
The fallback token is never persisted into the overlay: the UI save's JSON (incoming) is stored unchanged; only the in-memory cfg used to build the live source gets the env token.
The token is never logged or put in an error message.
HTTP source type is unaffected.

Verification

cargo fmt --check, cargo clippy --all-targets -D warnings, cargo build --all-targets, cargo test --lib all pass (pre-commit hook). New unit tests cover absent / blank / explicit-wins / no-env-noop / http-source cases. An adversarial review confirmed build_source has exactly two production callers, both guarded, and the seed path builds JSON only (no source), so no fallback site is missed.

Closes #VS-51.

## Problem A persisted `settings.agentbinaryfetcher` overlay saved through the admin UI without re-typing the redacted token persists with no token. Because the env seed only fills the section when no overlay exists (seed-once) and the seeded token is never written to the DB, that good env token is then shadowed forever: every fetch of the private Forgejo package returns 401, the agent catalog stays empty, and device-enrollment downloads 404 at `/vervainagents/:id` (surfaced in the apps `/agent/<id>` proxy as "agent download failed: 404 Not Found"). Hit in production on c-01; recovery required manually re-entering the token in the admin UI. ## Fix Resolve the Forgejo token from `VERVAIN_AGENT_FETCHER_TOKEN` / `..._TOKEN_FILE` when the overlay/config token is absent or blank. New `AgentBinaryFetcherConfig::apply_env_token_fallback()` (with a testable core `fill_forgejo_token_from`) in `crates/vervain-agent-fetch/src/config.rs`, called at the two source-build sites: boot-time fetch (`crates/vervain/src/boot.rs`) and runtime UI apply (`crates/vervain-web/src/settings_overlay.rs`). - An explicit non-empty token in the overlay/config still wins (env is fallback only). - The fallback token is never persisted into the overlay: the UI save's JSON (`incoming`) is stored unchanged; only the in-memory `cfg` used to build the live source gets the env token. - The token is never logged or put in an error message. - HTTP source type is unaffected. ## Verification `cargo fmt --check`, `cargo clippy --all-targets -D warnings`, `cargo build --all-targets`, `cargo test --lib` all pass (pre-commit hook). New unit tests cover absent / blank / explicit-wins / no-env-noop / http-source cases. An adversarial review confirmed `build_source` has exactly two production callers, both guarded, and the seed path builds JSON only (no source), so no fallback site is missed. Closes #VS-51.

nrupard added 1 commit

2026-06-24 16:04:59 +02:00

fix(fetcher): fall back to env token when overlay token absent

Check / fmt + clippy + build + tests (pull_request) Successful in 2m1s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

088cdb9828

A persisted `agentbinaryfetcher` overlay saved through the admin UI without re-typing the redacted token carries no token, and seed-once means the env-seeded token is never reused, so every fetch of a private package 401s and the agent catalog stays empty (enrollment downloads 404 via the apps `/agent/<id>` proxy). Resolve the Forgejo token from `VERVAIN_AGENT_FETCHER_TOKEN` / `..._TOKEN_FILE` when the overlay/config token is absent or blank, on both the boot-time (`boot.rs`) and runtime-apply (`settings_overlay.rs`) source-build paths. An explicit non-empty token still wins; the fallback token is never persisted into the overlay (the UI save's JSON is stored unchanged) and is never logged. Adds unit tests for the fill logic (absent/blank/explicit/http-source/no-env cases).

#VS-51